Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash

Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in…

Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have…

If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's…

Concurrent use of the URL parser with non-UTF-8 data was not thread-safe

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context,…

Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing…

The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy

An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key…

When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks

When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used

By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object…

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to…

When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses

If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new…

Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol

After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash

Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations

When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash

Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol

After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash

<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially…

Using the Location API in a loop could have caused severe application hangs and crashes

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols

When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL

The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection,…

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other…

Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing…

When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in…

The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service

The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page

A malicious extension could have opened a popup window lacking an address bar

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local…

When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the…

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an…

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to…

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to…

A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect