Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Mitigation bypass in the Networking: Cache component

Same-origin policy bypass in the Networking: JAR component

Use-after-free in the Graphics: ImageLib component

Incorrect boundary conditions in the Audio/Video: GMP component

Use-after-free in the DOM: Window and Location component

Use-after-free in the JavaScript Engine component

Invalid pointer in the JavaScript Engine component

Mitigation bypass in the DOM: Security component

Privilege escalation in the Netmonitor component

Integer overflow in the Libraries component in NSS

Privilege escalation in the Netmonitor component

Incorrect boundary conditions in the Networking: JAR component

Privilege escalation in the Messaging System component

Mitigation bypass in the DOM: HTML Parser component

Integer overflow in the Audio/Video component

Incorrect boundary conditions in the Web Audio component

Use-after-free in the Audio/Video: Playback component

Undefined behavior in the DOM: Core & HTML component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

Integer overflow in the JavaScript: Standard Library component

Incorrect boundary conditions in the Graphics: ImageLib component

Use-after-free in the JavaScript: GC component

Incorrect boundary conditions in the WebRTC: Audio/Video component

Memory safety bugs present in Firefox 146 and Thunderbird 146

Use-after-free in the JavaScript Engine component

Sandbox escape due to incorrect boundary conditions in the Graphics component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Audio/Video: GMP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the WebRTC: Signaling component

Memory safety bug present in Firefox 143 and Thunderbird 143

Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption

A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process

A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures

Use-after-free in MediaTrackGraphImpl::GetInstance()

Memory safety bugs present in Firefox 141 and Thunderbird 141

An attacker was able to perform memory corruption in the GMP process which processes encrypted media

Memory safety bugs present in Firefox 140 and Thunderbird 140

Focus incorrectly truncated URLs towards the beginning instead of around the origin

Thunderbird ignored paths when checking the validity of navigations in a frame

The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials

On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch…

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object

When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string