Mitigation bypass in the Networking: HTTP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the CSS Parsing and Computation component

Memory safety bugs fixed in Firefox 148 and Thunderbird 148

Invalid pointer in the DOM: Core & HTML component

Spoofing issue in the WebAuthn component in Firefox for Android

Use-after-free in the DOM: Core & HTML component

Use-after-free in the JavaScript: GC component

JIT miscompilation in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: GC component

Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS

Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Mitigation bypass in the Networking: Cache component

Same-origin policy bypass in the Networking: JAR component

Use-after-free in the Graphics: ImageLib component

Incorrect boundary conditions in the Audio/Video: GMP component

Use-after-free in the DOM: Window and Location component

Use-after-free in the JavaScript Engine component

Invalid pointer in the JavaScript Engine component

Mitigation bypass in the DOM: Security component

Privilege escalation in the Netmonitor component

Integer overflow in the Libraries component in NSS

Privilege escalation in the Netmonitor component

Incorrect boundary conditions in the Networking: JAR component

Privilege escalation in the Messaging System component

Mitigation bypass in the DOM: HTML Parser component

Integer overflow in the Audio/Video component

Incorrect boundary conditions in the Web Audio component

Use-after-free in the Audio/Video: Playback component

Undefined behavior in the DOM: Core & HTML component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

Integer overflow in the JavaScript: Standard Library component

Incorrect boundary conditions in the Graphics: ImageLib component

Use-after-free in the JavaScript: GC component

Incorrect boundary conditions in the WebRTC: Audio/Video component

Memory safety bugs fixed in Firefox 147 and Thunderbird 147

Use-after-free in the JavaScript Engine component

Sandbox escape due to incorrect boundary conditions in the Graphics component

Use-after-free in the Disability Access APIs component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Audio/Video: GMP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the WebRTC: Signaling component