Incorrect boundary conditions in the Graphics: ImageLib component

Use-after-free in the JavaScript: GC component

Incorrect boundary conditions in the WebRTC: Audio/Video component

Memory safety bugs fixed in Firefox 147 and Thunderbird 147

Use-after-free in the JavaScript Engine component

Sandbox escape due to incorrect boundary conditions in the Graphics component

Use-after-free in the Disability Access APIs component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Audio/Video: GMP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the WebRTC: Signaling component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component

JIT miscompilation in the JavaScript Engine: JIT component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component

Use-after-free in WebGPU internals triggered from a compromised child process

Memory safety bug fixed in Firefox 144 and Thunderbird 144

Use-after-free caused by the native messaging web extension API on Windows

Use-after-free in MediaTrackGraphImpl::GetInstance()

Cross-process information leaked due to malicious IPC messages

Out of bounds read/write in a privileged process triggered by WebGL textures

Passkey phishing within Bluetooth range

Sandboxed iframes could allow local downloads despite sandbox restrictions

Sandboxed iframe could start downloads

Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Sandbox escape due to invalid pointer in the Audio/Video: GMP component

Memory safety bugs fixed in Firefox 141 and Thunderbird 141

Incorrect URL truncation

CSP frame-src was not correctly enforced for paths

Incorrect URL stripping in CSP reports

Large branch table could lead to truncated instruction

WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate

Use-after-free in FontFaceSet

Integer overflow in OrderedHashTable

Memory corruption in canvas surfaces

Out-of-bounds access when resolving Promise objects

When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string

Memory safety bugs present in Firefox 134 and Thunderbird 134

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6

An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash

Memory safety bugs fixed in Firefox 134 and Thunderbird 134

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition

The executable file warning was not presented when downloading .library-ms files

Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2

A compromised content process could have allowed for the arbitrary loading of cross-origin pages

Memory safety bugs present in Firefox 129