Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component

JIT miscompilation in the JavaScript Engine: JIT component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component

Use-after-free in WebGPU internals triggered from a compromised child process

Memory safety bug fixed in Firefox 144 and Thunderbird 144

Use-after-free caused by the native messaging web extension API on Windows

Use-after-free in MediaTrackGraphImpl::GetInstance()

Cross-process information leaked due to malicious IPC messages

Out of bounds read/write in a privileged process triggered by WebGL textures

Passkey phishing within Bluetooth range

Sandboxed iframes could allow local downloads despite sandbox restrictions

Sandboxed iframe could start downloads

Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Sandbox escape due to invalid pointer in the Audio/Video: GMP component

Memory safety bugs fixed in Firefox 141 and Thunderbird 141

Incorrect URL truncation

CSP frame-src was not correctly enforced for paths

Incorrect URL stripping in CSP reports

Large branch table could lead to truncated instruction

WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate

Use-after-free in FontFaceSet

Integer overflow in OrderedHashTable

Memory corruption in canvas surfaces

Out-of-bounds access when resolving Promise objects

Disclosure of uninitialized memory when .toUpperCase() causes string to get longer

Memory safety bugs fixed in Firefox 135 and Thunderbird 135

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7

Use-after-free in XSLT

Memory safety bugs fixed in Firefox 134 and Thunderbird 134

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition

The executable file warning was not presented when downloading .library-ms files

Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2

A compromised content process could have allowed for the arbitrary loading of cross-origin pages

Memory safety bugs present in Firefox 129

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies

A mismatch between allocator and deallocator could have led to memory corruption

Memory safety bugs present in Firefox 126

In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive…

If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations,…

Memory safety bugs present in Firefox 125

Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free