Open Source Vulnerabilities

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitable ...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Using the Location API in a loop could have caused severe application hangs and crashes

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing ...

firefox, firefox, firefox, firefox, firefox

When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have caused the URL to load unintentionally, which could lead to...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Through a series of popup and <code>window

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped

firefox, firefox, firefox, firefox, firefox

WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used fo...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash

pistache, pistache, pistache

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL

ruby-crass, ruby-crass, ruby-crass

ruby-crass, ruby-crass, ruby-crass

ruby-crass, ruby-crass, ruby-crass

ruby-crass, ruby-crass, ruby-crass

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Security fix for CVE-2022-22764 applied in: firefox 97.0-r0, firefox-esr 91.6.0-r0

firefox, firefox, firefox, firefox, firefox

Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it

gst-plugins-base1.0, gst-plugins-base1.0, gst-plugins-base1.0

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy

gstreamer1-plugins-base

CVE-2026-119842 affecting package gstreamer1-plugins-base 1.20.0-3

gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-base1.0, gst-plugins-base1.0, gst-plugins-base1.0

gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0

gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0

gstreamer1-plugins-base

CVE-2026-119729 affecting package gstreamer1-plugins-base 1.20.0-3

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e

firefox, firefox, firefox, firefox, firefox

When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone number

firefox, firefox, firefox, firefox, firefox

Remote Agent, used in WebDriver, did not validate the Host or Origin headers

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after ...

firefox, firefox, firefox, firefox, firefox

By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) even after the tab wa...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions

firefox, firefox, firefox, firefox, firefox

Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory

gst-plugins-base1.0, gst-plugins-base1.0, gst-plugins-base1.0, gst-plugins-base1.0, gst-plugins-base1.0

gst-plugins-bad1.0, gst-plugins-bad1.0

gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0

gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0, gst-plugins-bad1.0

pistache, pistache

ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass

ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass

ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass

ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass, ruby-crass

firefox, firefox, firefox, firefox, firefox

Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 an...