The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification

A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for…

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these…

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server

An out-of-bounds read can occur when decoding H264 video

When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.<br>This…

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile)

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential…

Due to a layout change, iframe contents could have been rendered outside of its border

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary

When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type…

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process

Images from a different domain can be read using a canvas object in some circumstances

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems

By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new…

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys

By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system

A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page…

A website could have obscured the full screen notification by using the file open dialog

A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay

Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm

An attacker could have positioned a `datalist` element to obscure the address bar

In multiple cases browser prompts could have been obscured by popups controlled by content

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and…

If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification

When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could…

Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled…

By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the…

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user

If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page,…

If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame…

When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs

It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the…

By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer