When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in…

The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service

The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page

A malicious extension could have opened a popup window lacking an address bar

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local…

When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the…

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an…

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to…

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to…

A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect

When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have…

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript

A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash

WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how…

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names…

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using…

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using…

An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack

Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection

The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing…

Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to…

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute

An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code>…

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content

Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local…

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS

A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one…

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data…

If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities

If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin…