2022

When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of prev

When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to une

IBM Security Verify Governance, Identity Manager 10.0.1 software component could allow an authenticated user to modify

Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firef

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evid

An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulti

An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulti

In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number

Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own conte

The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applica

The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however

ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed

SVG <code>&lt;use&gt;</code> tags that referenced a same-origin document could have resulted in script execution if atta

Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect h

The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code>&lt;use&gt;</code> tags; however i

If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, r

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version sel

Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affec

When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to b

An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This

Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported m

Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs presen

Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header.

If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnera

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so by

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. Th

An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the

A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further

On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a

When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly bein

When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting

A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially ex

A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerabi

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs s

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an emai

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScri

Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Fi

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bug

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Thi

The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have e

The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affec

An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could

When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origi

Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team r

Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory s

In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. T