2022

An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability af

Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some o

Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of t

If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server th

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the brow

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers bei

Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing

When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox

If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a

Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause

When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink

Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access

When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the Se

The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> m

Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seein

If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred,

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while refere

Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free a

Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without

Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for

Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firef

Logins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk.

If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUt

If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may p

Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have

A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirec

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reporte

During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially ex

Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leak

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context c

Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<b

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected elem

An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerab

When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the recei

When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to

If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute t

Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR

Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firef

A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerabilit

An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was ze

A website that had permission to access the microphone could record audio without the audio notification being shown. Th

A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs s

When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates tha

When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability

When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this co

When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus le