Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly

When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash

Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the…

The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect

Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs

A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox <…

When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read…

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash

A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we…

The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer

Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or…

Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses

When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it

Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user…

Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash

Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in…

Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have…

If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's…

Concurrent use of the URL parser with non-UTF-8 data was not thread-safe

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context,…

Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing…

The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy

An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key…

When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks

When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used

By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object…

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to…

When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses

If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new…

Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol

After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash

Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations

When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash

Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol

After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash

<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially…

Using the Location API in a loop could have caused severe application hangs and crashes

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols

When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL

The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection,…

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other…

Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing…