An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash

Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5

A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place

Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4

When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in…

The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and…

Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firefox ESR 102.3

Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable…

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR…

Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12

Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1

A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access)

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10

In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replace was too large for the container

An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link

A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption

On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash

When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables…

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting…

Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading…

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash

Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefox ESR 91.5

When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible

Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content…

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run…

Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs…

The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell

Certain network request objects were freed too early when releasing a network request handle

Applying a CSS filter effect could have accessed out of bounds memory

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code…

An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately…

Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers

An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash

A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2

The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's computer.*Note: This issue only…

When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially…

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0

Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12

Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash

A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash

Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection

Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash