Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Mitigation bypass in the Networking: Cache component

Same-origin policy bypass in the Networking: JAR component

Use-after-free in the Graphics: ImageLib component

Incorrect boundary conditions in the Audio/Video: GMP component

Use-after-free in the DOM: Window and Location component

Use-after-free in the JavaScript Engine component

Invalid pointer in the JavaScript Engine component

Mitigation bypass in the DOM: Security component

Privilege escalation in the Netmonitor component

Integer overflow in the Libraries component in NSS

Privilege escalation in the Netmonitor component

Incorrect boundary conditions in the Networking: JAR component

Privilege escalation in the Messaging System component

Mitigation bypass in the DOM: HTML Parser component

Integer overflow in the Audio/Video component

Incorrect boundary conditions in the Web Audio component

Use-after-free in the Audio/Video: Playback component

Undefined behavior in the DOM: Core & HTML component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

Integer overflow in the JavaScript: Standard Library component

Incorrect boundary conditions in the Graphics: ImageLib component

Use-after-free in the JavaScript: GC component

Incorrect boundary conditions in the WebRTC: Audio/Video component

Memory safety bugs fixed in Firefox 147 and Thunderbird 147

Use-after-free in the JavaScript Engine component

Sandbox escape due to incorrect boundary conditions in the Graphics component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Audio/Video: GMP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the WebRTC: Signaling component

Memory safety bug fixed in Firefox 144 and Thunderbird 144

Use-after-free caused by the native messaging web extension API on Windows

Use-after-free in MediaTrackGraphImpl::GetInstance()

Cross-process information leaked due to malicious IPC messages

Out of bounds read/write in a privileged process triggered by WebGL textures

Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Sandbox escape due to invalid pointer in the Audio/Video: GMP component

Memory safety bugs fixed in Firefox 141 and Thunderbird 141

Incorrect URL truncation

CSP frame-src was not correctly enforced for paths

Incorrect URL stripping in CSP reports

Large branch table could lead to truncated instruction

Out-of-bounds access when resolving Promise objects

Disclosure of uninitialized memory when .toUpperCase() causes string to get longer