Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Sandbox escape due to incorrect boundary conditions in the WebRTC component

Sandbox escape due to incorrect boundary conditions in the Graphics component

Sandbox escape due to invalid pointer in the Graphics component

Sandbox escape in the DOM: Core & HTML component

Sandbox escape due to use-after-free in the DOM: Security component

Sandbox escape due to use-after-free in the DOM: Navigation component

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Workers component

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component

Insufficient checks when processing graphics shared memory could have led to memory corruption

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when…

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g

Incorrect boundary conditions in the DOM: Editor component

Same-origin policy bypass in the Networking: HTTP component

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a…

Incorrect boundary conditions in the Graphics: WebGPU component

Mitigation bypass in the Widget: Win32 component

Mitigation bypass in the Networking component

Mitigation bypass in the Enterprise Policies component

Spoofing issue due to invalid pointer in the Graphics component

Sandbox escape due to race condition in the XPConnect component

Mitigation bypass in the DOM: Networking component

Mitigation bypass in the Remote Settings Client component

Site isolation issue in the Graphics component

Site isolation issue in the CSS Parsing and Computation component

Side-channel in the Web Audio component

Same-origin policy bypass in the DOM: Service Workers component

Mitigation bypass in the JavaScript: GC component

Mitigation bypass in the Storage: Cache API component

Mitigation bypass in the Networking component

Mitigation bypass in the DOM: Security component

Incorrect boundary conditions in the Audio/Video: GMP component

Incorrect boundary conditions in the Graphics: WebGPU component

JIT miscompilation in the JavaScript Engine: JIT component

Mitigation bypass in the Enterprise Policies component

Same-origin policy bypass in the Networking: DNS component

Mitigation bypass in the Networking component

Mitigation bypass in the DOM: Networking component

Incorrect boundary conditions in the Audio/Video: Playback component

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component

Same-origin policy bypass in the Networking: Cookies component

Same-origin policy bypass in the DOM: Networking component