When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type…

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process

Images from a different domain can be read using a canvas object in some circumstances

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems

By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new…

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys

By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system

A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page…

A website could have obscured the full screen notification by using the file open dialog

A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay

Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm

An attacker could have positioned a `datalist` element to obscure the address bar

In multiple cases browser prompts could have been obscured by popups controlled by content

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and…

If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification

When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could…

Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled…

By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the…

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user

If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page,…

If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame…

When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs

It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the…

By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer

A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the…