Constructing audio sinks could have lead to a race condition when playing audio files and closing windows

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile…

When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially…

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a…

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a…

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to…

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES

A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory

A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the…

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory

Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor

The date picker could partially obscure security prompts

ANGLE failed to initialize parameters which lead to reading from uninitialized memory

Select options could obscure the fullscreen notification dialog

In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain

When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy

A Linux user opening the print preview dialog could have caused the browser to crash

An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash

`EncryptingOutputStream` was susceptible to exposing uninitialized data

The `VideoBridge` allowed any content process to use textures produced by remote decoders

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer

During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable…

A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a…

Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information

When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`

When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to…

When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed…

When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed…

When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash

The Firefox updater created a directory writable by non-privileged users

A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the…

A type checking bug would have led to invalid code being compiled

An out-of-bound read could have led to a crash in the RLBox Expat driver

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result

When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of…

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds