When using nested workers, a use-after-free could occur during worker destruction

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory…

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling

An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed

When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application

A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use

Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8

Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68

Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies

NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site

A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the…

An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash

An integer overflow can occur in the SwizzleData code while calculating buffer sizes

A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element

A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the…

On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a…

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects…

A race condition is present in the crash generation server used to generate data for the crash reporter

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised…

It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site

After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the…

A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`

A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash

A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially…

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability

If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the…

When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code

Firefox could be made to load attacker-supplied DLL files from the installation directory

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in…

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin

Type Confusion in Async Generators in Javascript Engine

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support

During garbage collection extra operations were performed on a object that should not be

Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not…

Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service

A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability

When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been…

When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode