Integer overflow in the Libraries component in NSS

Privilege escalation in the Netmonitor component

Incorrect boundary conditions in the Networking: JAR component

Privilege escalation in the Messaging System component

Mitigation bypass in the DOM: HTML Parser component

Integer overflow in the Audio/Video component

Incorrect boundary conditions in the Web Audio component

Use-after-free in the Audio/Video: Playback component

Undefined behavior in the DOM: Core & HTML component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

Integer overflow in the JavaScript: Standard Library component

Incorrect boundary conditions in the Graphics: ImageLib component

Use-after-free in the JavaScript: GC component

Incorrect boundary conditions in the WebRTC: Audio/Video component

Memory safety bugs fixed in Firefox 147 and Thunderbird 147

Use-after-free in the JavaScript Engine component

Sandbox escape due to incorrect boundary conditions in the Graphics component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Audio/Video: GMP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the WebRTC: Signaling component

Memory safety bug fixed in Firefox 144 and Thunderbird 144

Use-after-free caused by the native messaging web extension API on Windows

Use-after-free in MediaTrackGraphImpl::GetInstance()

Cross-process information leaked due to malicious IPC messages

Out of bounds read/write in a privileged process triggered by WebGL textures

Memory safety bugs present in Firefox 141 and Thunderbird 141

An attacker was able to perform memory corruption in the GMP process which processes encrypted media

Memory safety bugs present in Firefox 140 and Thunderbird 140

Focus incorrectly truncated URLs towards the beginning instead of around the origin

Thunderbird ignored paths when checking the validity of navigations in a frame

The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials

On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch…

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object

When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string

Memory safety bugs present in Firefox 134 and Thunderbird 134

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6

An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash

Memory safety bugs fixed in Firefox 134 and Thunderbird 134

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition

The executable file warning was not presented when downloading .library-ms files

Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2