Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements

Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements

A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest

Insufficient checks when processing graphics shared memory could have led to memory corruption

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when…

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free

Unexpected marking work at the start of sweeping could have led to a use-after-free

Editor code failed to check an attribute value

Incomplete WebAssembly exception handing could have led to a use-after-free

A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution

Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6

A malicious devtools extension could have been used to escalate privileges

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions

Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5

The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor

A use-after-free was identified in the `nsDNSService::Init`

The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode

A use-after-free condition affected TLS socket creation when under memory pressure

Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4

When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard

Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5

Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1

Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1

Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS

During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash

Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free

An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS

Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety…

When reading a file, an uninitialized value could have been used as read limit

A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions

Memory safety bugs present in Firefox 111 and Firefox ESR 102.9

Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character

An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially…

Memory safety bugs present in Firefox 110 and Firefox ESR 102.8

While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type

Memory safety bugs present in Firefox ESR 102.7

Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7

Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>

An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after…