Incorrect boundary conditions in the Graphics: WebGPU component

Out-of-bounds read in IMAP response parser

Mitigation bypass in the Widget: Win32 component

Mitigation bypass in the Networking component

Mitigation bypass in the Enterprise Policies component

Spoofing issue due to invalid pointer in the Graphics component

Sandbox escape due to race condition in the XPConnect component

Mitigation bypass in the DOM: Networking component

Mitigation bypass in the Remote Settings Client component

Site isolation issue in the Graphics component

Uninitialized memory in MIME parsing

Site isolation issue in the CSS Parsing and Computation component

Side-channel in the Web Audio component

Same-origin policy bypass in the DOM: Service Workers component

Mitigation bypass in the JavaScript: GC component

Mitigation bypass in the Storage: Cache API component

Incorrect boundary conditions in the Audio/Video: GMP component

Incorrect boundary conditions in the Graphics: WebGPU component

JIT miscompilation in the JavaScript Engine: JIT component

Mitigation bypass in the Enterprise Policies component

Same-origin policy bypass in the Networking: DNS component

Mitigation bypass in the Networking component

Mitigation bypass in the DOM: Networking component

Incorrect boundary conditions in the Audio/Video: Playback component

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component

Same-origin policy bypass in the Networking: Cookies component

Same-origin policy bypass in the DOM: Networking component

Undefined behavior in the Audio/Video component

Uninitialized memory in the Graphics: Text component

Setting a nameless cookie with an equals sign in the value shadowed other cookies

A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process…

`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL

An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data

An out-of-bounds read while processing SVG content in "ConvolvePixel"

An out-of-bounds read during the processing of glyph widths during text layout

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers…

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the DOM: UI Events & Focus Handling component

Use-after-free in the JavaScript Engine: JIT component

Privilege escalation in the Places component

Privilege escalation in the Address Bar component

Use-after-free in the CSS Parsing and Computation component

Incorrect boundary conditions in the JavaScript Engine: JIT component

Invalid pointer in the JavaScript Engine: JIT component

Mitigation bypass in the DOM: Service Workers component

Privilege escalation in the DOM: Service Workers component

Privilege escalation in the DLL Services component