The executable file warning was not presented when downloading .xrm-ms files

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination

Memory safety bugs present in Firefox 123

The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain

Memory safety bugs present in Firefox 118

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2

During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed from a different codepath, leading to a potentially…

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially…

A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential use-after-free and exploitable crash

A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a…

Memory safety bugs present in Firefox 115

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13

Memory safety bugs present in Firefox 113

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download

An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior

Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash

A use-after-free in WebGL extensions could have led to a potentially exploitable crash

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102

Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101

ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1

Session history navigations may have led to a use-after-free and potentially exploitable crash

Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100

Mozilla developers Andrew McCreight, Nicolas B

A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash

A malicious website could have learned the size of a cross-origin resource that supported Range requests

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8

The search term could have been specified externally to trigger SQL injection

Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in…

If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted that permission

The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a…

Mozilla developers reported memory safety bugs present in Firefox 81

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC

Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks

Mozilla developers and community members reported memory safety bugs present in Firefox 75

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7

Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6

A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and…

Mozilla developers reported memory safety and script safety bugs present in Firefox 73

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5

Mozilla developers and community members reported memory safety bugs present in Firefox 68

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog

A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use

A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash