2018

Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension ma

When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoo

If cursor visibility is toggled by script using from 'none' to an image and back through script, the cursor will be rend

An audio capture session can started under an incorrect origin from the site making the capture request. Users are still

A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data

The printing process can bypass local access protections to read files available through symlinks, bypassing local file

Style editor traffic in the Developer Tools can be routed through a service worker hosted on a third party website if a

WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file. This can result in an

A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, res

A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This resul

A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potent

A use-after-free vulnerability can occur when manipulating floating "first-letter" style elements, resulting in a potent

A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" function are freed while

A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that h

A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script conte

A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is m

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exp

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at l

A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collec

A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially e

A use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory prematurely instead of fr

A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers. This results i

Memory safety bugs were reported in Firefox 57. Some of these bugs showed evidence of memory corruption and we presume t

Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corrup

RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affec

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed

A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used fo

A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image ca

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprin

If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" e

JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved b

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be i

Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-doma

SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerabili

The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attac

Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resou

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for b

Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-

The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or

A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_expose

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The r

A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been free

Memory safety bugs were reported in Firefox 56. Some of these bugs showed evidence of memory corruption and we presume t

Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corrup

Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of a

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. T

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to beh

The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NI