Open Source Vulnerabilities

firefox, firefox, firefox, firefox, firefox

object tag with a data URI did not correctly inherit the document's Content Security Policy

firefox, firefox, firefox, firefox, firefox

compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If two same-origin documents set document

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

In libexpat before 2

firefox, firefox, firefox, firefox, firefox

Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion

firefox, firefox, firefox, firefox, firefox

Mozilla developers reported memory safety bugs present in Firefox 71

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68

firefox, firefox, firefox, firefox, firefox

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters

firefox, firefox, firefox, firefox, firefox

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet

firefox, firefox, firefox, firefox, firefox

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule

firefox, firefox, firefox, firefox, firefox

Mozilla developers reported memory safety and script safety bugs present in Firefox 73

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68

firefox, firefox, firefox, firefox, firefox

When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the ...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

first time AirPods are connected to an iPhone, they become named after the user's name by default (e

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

firefox, firefox, firefox, firefox, firefox

After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode

firefox, firefox, firefox, firefox, firefox

When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files

firefox, firefox, firefox, firefox, firefox

When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a use-after-free and a potenti...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free

firefox, firefox, firefox, firefox, firefox

Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68

firefox, firefox, firefox, firefox, firefox

Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open

firefox, firefox, firefox, firefox, firefox

malicious extension could have called <code>browser

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero

firefox, firefox, firefox, firefox, firefox

Mozilla developers and community members reported memory safety bugs present in Firefox 75

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68

firefox, firefox, firefox, firefox, firefox

logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website

firefox, firefox, firefox, firefox, firefox

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context

firefox, firefox, firefox, firefox, firefox

Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

race condition when running shutdown code for Web Worker led to a use-after-free vulnerability

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

buffer overflow could occur when parsing and validating SCTP chunks in WebRTC