Open Source Vulnerabilities

firefox, firefox, firefox, firefox, firefox

Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers

firefox, firefox, firefox, firefox, firefox

Mozilla developers and community members reported memory safety bugs present in Firefox 90

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox

After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default locatio...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection

firefox, firefox, firefox, firefox, firefox

Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit

firefox, firefox, firefox, firefox, firefox

Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102

firefox, firefox, firefox, firefox, firefox

issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access)

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102

firefox, firefox, firefox, firefox, firefox

Mozilla developers reported memory safety bugs present in Firefox 92

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Through use of reportValidity() and window

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Concurrent use of the URL parser with non-UTF-8 data was not thread-safe

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

out-of-bounds read can occur when decoding H264 video

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

executable file warning was not presented when downloading

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firefox ESR 102

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If a website called `window

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in th...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certa...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cook...