2022

If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred,

Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firef

If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUt

Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have

A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirec

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reporte

When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the recei

If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag

Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR

Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firef

A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerabilit

A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or

When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates tha

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evid

An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulti

An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulti

In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number

Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer

The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however

When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to b

An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This

A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further

On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a

When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly bein

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs s

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScri

Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Fi

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origi

Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team r

Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory s

SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script i

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent pr

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of at

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming t

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploi

Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefo

When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it shoul

Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors d

When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone nu

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been

By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute J

A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write a

Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these b

Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon

The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This c

When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. T

Certain network request objects were freed too early when releasing a network request handle. This could have lead to a

Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow ca

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could ha

If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched t