2022

Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user conf

When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjun

SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script i

The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include

By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent pr

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of at

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming t

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>,

In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scri

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This

While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fo

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploi

Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefo

When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it shoul

Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed un

Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors d

When importing resources using Web Workers, error messages would distinguish the difference between <code>application/ja

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the

When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone nu

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connec

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been

By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute J

If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so,

A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write a

Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these b

Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon

By generally accepting and passing resource handles across processes, a compromised content process might have confused

When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.

Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handlin

After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have le

A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window s

Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerabi

The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This c

When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the

When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potenti

When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. T

Certain network request objects were freed too early when releasing a network request handle. This could have lead to a

Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This

Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow ca

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could ha

If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched t

IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could a

The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iO

When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have

An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScri

When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both,