If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and…

Clickjacking issue in the Downloads component in Firefox for Android

Clickjacking issue in Firefox for Android

Cross-origin cookies could be leaked when opening a PDF link

When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This…

When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information

Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result

If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced

Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header

By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as…

OneCRL was non-functional in the new Firefox for Android due to a missing service initialization

When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of…

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to…

A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file

A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain

IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of…

The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129

Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129

Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129

When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information

When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack

Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without…

Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed

Spoofing issue in the Downloads component in Firefox for Android

Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS

Spoofing issue in the Downloads component in Firefox for Android

Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent…

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack

Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS

Information disclosure in the WebExtensions component in Firefox for Android

Cookie injection was possible when opening a PDF link

In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects…

Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and…

A website that had permission to access the microphone could record audio without the audio notification being shown

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other…

A lock was missing when accessing a data structure and importing certificate information into the trust database

For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions