The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page

A malicious extension could have opened a popup window lacking an address bar

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local…

When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the…

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an…

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to…

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to…

A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect

When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have…

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript

A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash

WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how…

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names…

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using…

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using…

An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction

Memory corruption in WebGL API

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed

Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility…

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack

Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection

Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy

A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions

Using a markup injection an attacker could have stolen nonce values

The permission prompt input delay could expire while the window is not in focus

Set-Cookie response headers were being incorrectly honored in multipart HTTP responses

A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have…

If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted…

The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing…

Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to…

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute

An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code>…

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content

Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local…

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS