A compromised content process could have allowed for the arbitrary loading of cross-origin pages

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment

Incorrect handling of SameSite cookies

Memory corruption in NSS

The executable file warning was not presented when downloading .xrm-ms files

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially…

A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a…

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash

Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages

A use-after-free in WebGL extensions could have led to a potentially exploitable crash

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape

Session history navigations may have led to a use-after-free and potentially exploitable crash

Mozilla developers Andrew McCreight, Nicolas B

A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash

A malicious website could have learned the size of a cross-origin resource that supported Range requests

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8

Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in…

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5

A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use

A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6

A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7

A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially…

A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially…

A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable…

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux

A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash

A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed

A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected

A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs

The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout

The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT)…

A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use

Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5

A use-after-free vulnerability can occur while playing a sound notification in Thunderbird