Mozilla Firefox any version

Incorrect boundary conditions, integer overflow in the Libraries component in NSS

JIT miscompilation in the JavaScript Engine: JIT component

Internally found bugs fixed in Firefox 155

Integer overflow in the Libraries component in NSS

Memory safety bugs fixed in Firefox 135 and Thunderbird 135

Mitigation bypass in the DOM: Security component

Mitigation bypass in the Networking: Cache component

Use-after-free in the JavaScript Engine component

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

Privilege escalation in the Enterprise Policies component

Mitigation bypass in the Add-ons Manager component

Mitigation bypass in the DOM: Security component

Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

Invalid pointer in the DOM: Bindings (WebIDL) component

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.

Mitigation bypass in the Networking: Cookies component

Mitigation bypass in the Networking: Cookies component

Use-after-free in MediaTrackGraphImpl::GetInstance()

Large branch table could lead to truncated instruction

JIT miscompilation in the JavaScript Engine: JIT component

Memory safety bugs fixed in Firefox 153

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the Layout: Text and Fonts component

Memory safety bugs fixed in Firefox 148 and Thunderbird 148

Sandboxed iframes could allow local downloads despite sandbox restrictions

Disclosure of uninitialized memory when .toUpperCase() causes string to get longer

Sandboxed iframe could start downloads

Use-after-free in the Graphics: ImageLib component

Use-after-free in the DOM: Window and Location component

Use-after-free in the JavaScript Engine component

Use-after-free in the DOM: Core & HTML component

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component

Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS

Invalid pointer in the JavaScript Engine component

Incorrect URL stripping in CSP reports

Use-after-free in Custom Highlight

Memory safety bugs fixed in Firefox 149 and Thunderbird 149

Use-after-free in the Audio/Video: GMP component