Integer overflow in the Libraries component in NSS

Privilege escalation in the Netmonitor component

Incorrect boundary conditions in the Networking: JAR component

Privilege escalation in the Messaging System component

Mitigation bypass in the DOM: HTML Parser component

Integer overflow in the Audio/Video component

Incorrect boundary conditions in the Web Audio component

Use-after-free in the Audio/Video: Playback component

Undefined behavior in the DOM: Core & HTML component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

Integer overflow in the JavaScript: Standard Library component

Incorrect boundary conditions in the Graphics: ImageLib component

Use-after-free in the JavaScript: GC component

Incorrect boundary conditions in the WebRTC: Audio/Video component

Memory safety bugs fixed in Firefox 147 and Thunderbird 147

Use-after-free in the JavaScript Engine component

Sandbox escape due to incorrect boundary conditions in the Graphics component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Audio/Video: GMP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the WebRTC: Signaling component

Memory safety bug fixed in Firefox 144 and Thunderbird 144

Use-after-free caused by the native messaging web extension API on Windows

Use-after-free in MediaTrackGraphImpl::GetInstance()

Cross-process information leaked due to malicious IPC messages

Out of bounds read/write in a privileged process triggered by WebGL textures

Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Sandbox escape due to invalid pointer in the Audio/Video: GMP component

Memory safety bugs fixed in Firefox 141 and Thunderbird 141

Incorrect URL truncation

CSP frame-src was not correctly enforced for paths

Incorrect URL stripping in CSP reports

Large branch table could lead to truncated instruction

Out-of-bounds access when resolving Promise objects

Disclosure of uninitialized memory when .toUpperCase() causes string to get longer

Memory safety bugs fixed in Firefox 135 and Thunderbird 135

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7

Use-after-free in XSLT

Memory safety bugs fixed in Firefox 134 and Thunderbird 134

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path

The executable file warning was not presented when downloading .library-ms files

Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2