When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have…

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript

A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash

WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how…

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names…

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using…

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using…

An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack

Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection

The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing…

Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to…

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute

An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code>…

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content

Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local…

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS

A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one…

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data…

If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities

If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin…

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification

A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for…

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these…

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server

An out-of-bounds read can occur when decoding H264 video

When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.<br>This…

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile)

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential…

Due to a layout change, iframe contents could have been rendered outside of its border

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary