Mozilla Firefox any version

Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2

Use-after-free in the JavaScript Engine component

Mitigation bypass in the Networking: HTTP component

Memory safety bugs fixed in Firefox 147 and Thunderbird 147

Use-after-free in the JavaScript Engine component

Use-after-free during concurrent delazification

Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Memory safety bugs fixed in Firefox 141 and Thunderbird 141

Memory safety bugs present in Firefox 125. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126.

Privilege escalation in the Netmonitor component

Integer overflow in the JavaScript: WebAssembly component

JIT miscompilation in the JavaScript: WebAssembly component

Integer overflow in the Audio/Video: Playback component

Privilege escalation in the Netmonitor component

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Cross-process information leaked due to malicious IPC messages

Out of bounds read/write in a privileged process triggered by WebGL textures

Privilege escalation in the Netmonitor component

Passkey phishing within Bluetooth range

Incorrect boundary conditions in the Audio/Video component

Incorrect boundary conditions in the Audio/Video: cubeb component

Incorrect boundary conditions in the Graphics component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Widget: Cocoa component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the DOM: Navigation component

Sandbox escape due to use-after-free in the Disability Access APIs component

Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132 and Thunderbird < 132.

Incorrect boundary conditions in the JavaScript: WebAssembly component

Mitigation bypass in the DOM: Networking component

Mitigation bypass in the PDF Viewer component

The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain. Under the correct circumstances, an attacker may have been able to poison the local browser cache by priming it with a `fetch()` response controlled by the additional headers. Upon navigation to the same URL, the user would see the cached response instead of the expected response. This vulnerability affects Firefox < 123.

Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129.

Incorrect URL truncation

Other issue in the DOM: Navigation component

Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15

Mitigation bypass in the DOM: Service Workers component

Sandbox escape in the DOM: Networking component

Memory safety bug fixed in Firefox 144 and Thunderbird 144