2018

RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affec

A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image ca

If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" e

JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved b

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be i

Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-doma

SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerabili

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for b

Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-

The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or

A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_expose

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The r

Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of a

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to beh

The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NI

The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or a

A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake ad

WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security che

On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will ha

If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that other

A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against

JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is supp

On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary

If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid

An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected,

An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can

A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the loc

The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using

Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the add

Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users.

If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, trigger

Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attac

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not

When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL par

Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled ou

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event cou

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If

On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is starte

A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressba

An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leaka

When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the

An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leadin

The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating sys

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a specia