Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11

Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header

When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent…

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to…

When Responsive Design Mode was enabled, it used references to objects that were previously freed

A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write

Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8

Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7

Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6

Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash

Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the…

When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type

Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed

Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers

Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4

If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable…

During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable…

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2

Mozilla developers reported memory safety bugs present in Firefox for Android 79

When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0

JIT optimizations involving the Javascript arguments object could confuse later optimizations

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash

When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition

Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a…

By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution

When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types

A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash

During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2

When using nested workers, a use-after-free could occur during worker destruction

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory…

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling