Mozilla Firefox Use-After-Free Vulnerability

Mozilla Firefox Use-After-Free Vulnerability

Other issue in Firefox Focus for Android

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute

Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android

Privilege escalation in Firefox for Android

Privilege escalation in Firefox for Android

Memory safety bugs present in Firefox 111

Memory safety bugs present in Firefox 111 and Firefox ESR 102.9

An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector

Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character

An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially…

Mozilla developers reported memory safety bugs present in Firefox for Android 79

A select option could partially obscure security prompts

Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs

Information disclosure in the Privacy component in Firefox for Android

A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30

Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions

Spoofing issue in Firefox for Android

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and…

Clickjacking issue in the Downloads component in Firefox for Android

Clickjacking issue in Firefox for Android

Cross-origin cookies could be leaked when opening a PDF link

When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This…

When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information

Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result

If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced

Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header

By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as…

OneCRL was non-functional in the new Firefox for Android due to a missing service initialization

When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of…

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to…

A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file

A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain

IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of…

The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129

Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129

Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129

When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information

When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack

Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without…

Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed

Spoofing issue in the Downloads component in Firefox for Android