Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies

A mismatch between allocator and deallocator could have led to memory corruption

Memory safety bugs present in Firefox 126

In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive…

If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations,…

Memory safety bugs present in Firefox 125

Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free

The executable file warning was not presented when downloading .xrm-ms files

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination

Memory safety bugs present in Firefox 123

The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain

Memory safety bugs present in Firefox 118

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2

During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed from a different codepath, leading to a potentially…

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially…

A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential use-after-free and exploitable crash

A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a…

Memory safety bugs present in Firefox 115

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13

Memory safety bugs present in Firefox 113

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download

An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior

Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash

A use-after-free in WebGL extensions could have led to a potentially exploitable crash

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102

Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101

ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1

Session history navigations may have led to a use-after-free and potentially exploitable crash

Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100

Mozilla developers Andrew McCreight, Nicolas B

A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash

A malicious website could have learned the size of a cross-origin resource that supported Range requests

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8

The search term could have been specified externally to trigger SQL injection

Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in…

If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted that permission

The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a…

Mozilla developers reported memory safety bugs present in Firefox 81

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC

Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks