2022

Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leak

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context c

Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<b

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected elem

An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerab

When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute t

An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was ze

A website that had permission to access the microphone could record audio without the audio notification being shown. Th

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was

When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability

When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this co

When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus le

When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of prev

When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to une

IBM Security Verify Governance, Identity Manager 10.0.1 software component could allow an authenticated user to modify

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own conte

The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applica

SVG <code>&lt;use&gt;</code> tags that referenced a same-origin document could have resulted in script execution if atta

Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect h

The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code>&lt;use&gt;</code> tags; however i

If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, r

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version sel

Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header.

If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnera

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so by

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. Th

An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the

When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an emai

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Thi

The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have e

The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affec

An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could

When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note

In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. T

Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user conf

When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjun

The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include

By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>,

In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This

While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fo

Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed un

When importing resources using Web Workers, error messages would distinguish the difference between <code>application/ja

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connec