Open Source Vulnerabilities

firefox, firefox, firefox, firefox, firefox

By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged pr...

firefox, firefox, firefox, firefox, firefox

When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Applying a CSS filter effect could have accessed out of bounds memory

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows

firefox, firefox, firefox, firefox, firefox

If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries

firefox, firefox, firefox, firefox, firefox

Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox wo...

firefox, firefox, firefox, firefox, firefox

In unusual circumstances, an individual thread may outlive the thread's manager during shutdown

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to ...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification

firefox, firefox, firefox, firefox, firefox

While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox

Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91

firefox, firefox, firefox, firefox, firefox

Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 98

firefox, firefox, firefox, firefox, firefox

In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Due to a layout change, iframe contents could have been rendered outside of its border

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used

firefox, firefox, firefox, firefox, firefox

SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances

firefox, firefox, firefox, firefox, firefox

sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed p...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruptio...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

regex is an implementation of regular expressions for the Rust language

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash

firefox, firefox, firefox, firefox, firefox

Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables

firefox, firefox, firefox, firefox, firefox

Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present

firefox, firefox, firefox, firefox, firefox

When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level perm...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged co...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled Jav...

firefox, firefox, firefox, firefox, firefox

Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers Andrew McCreight, Nicolas B

firefox, firefox, firefox, firefox, firefox

If array shift operations are not used, the Garbage Collector may have become confused about valid objects

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy

firefox, firefox, firefox, firefox, firefox

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers