The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain…

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey…

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow…

Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG…

Mitigation bypass in the DOM: Security component

Mitigation bypass in the Bookmarks & History component

Sandbox escape due to incorrect boundary conditions in the XPCOM component

Sandbox escape due to use-after-free in the Widget: Gtk component

Sandbox escape due to use-after-free in the DOM: Core & HTML component

Sandbox escape due to use-after-free in the Preferences: Backend component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to incorrect boundary conditions in the Internationalization component

Sandbox escape in the XUL component

Sandbox escape due to use-after-free in the Graphics component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Sandbox escape due to use-after-free in the DOM: Core & HTML component

Sandbox escape in the Graphics component

Sandbox escape due to use-after-free in the DOM: Content Processes component

Sandbox escape due to use-after-free in the DOM: Content Processes component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Sandbox escape due to incorrect boundary conditions in the WebRTC component

Sandbox escape due to incorrect boundary conditions in the Graphics component

Sandbox escape due to invalid pointer in the Graphics component

Sandbox escape in the DOM: Core & HTML component

Sandbox escape due to use-after-free in the DOM: Security component

Sandbox escape due to use-after-free in the DOM: Navigation component

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Workers component

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component

Insufficient checks when processing graphics shared memory could have led to memory corruption

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when…

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g

Incorrect boundary conditions in the DOM: Editor component

Same-origin policy bypass in the Networking: HTTP component

Incorrect boundary conditions in the Graphics: WebGPU component

Out-of-bounds read in IMAP response parser

Mitigation bypass in the Widget: Win32 component

Mitigation bypass in the Networking component

Mitigation bypass in the Enterprise Policies component

Spoofing issue due to invalid pointer in the Graphics component

Sandbox escape due to race condition in the XPConnect component

Mitigation bypass in the DOM: Networking component

Mitigation bypass in the Remote Settings Client component

Site isolation issue in the Graphics component