Mozilla developers and community members reported memory safety bugs present in Firefox 75

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7

Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6

A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and…

Mozilla developers reported memory safety and script safety bugs present in Firefox 73

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5

Mozilla developers and community members reported memory safety bugs present in Firefox 68

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog

A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use

A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 66

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6

Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances

A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 67

Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux

A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash

A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed

A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption

In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional…

A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected

A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs

The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout

The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT)…

A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use

Mozilla developers and community members reported memory safety bugs present in Firefox 65

Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling

Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3

Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module

A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of…

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4

A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations

Mozilla developers and community members reported memory safety bugs present in Firefox 64

Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8

Memory safety bugs present in Firefox 60 and Firefox ESR 60

Memory safety bugs present in Firefox 60

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring

A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored

A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use

Memory safety bugs present in Firefox 61 and Firefox ESR 60.1

WebExtensions bundled with embedded experiments were not correctly checked for proper authorization

Mozilla developers backported selected changes in the Skia library