Mozilla Firefox any version

Incorrect boundary conditions in the Graphics: WebGPU component

Incorrect boundary conditions in the Graphics: WebGPU component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component

JIT miscompilation in the JavaScript Engine: JIT component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component

Use-after-free caused by the native messaging web extension API on Windows

Clickjacking issue in the DOM: Events component

Integer overflow in the Graphics: ImageLib component

Integer overflow in the Audio/Video component

Use-after-free in the Disability Access APIs component

Memory safety bugs fixed in Thunderbird ESR 140.13

Use-after-free in WebGPU internals triggered from a compromised child process

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Graphics: WebGPU component

WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate

Site isolation issue in the DOM: Push Subscriptions component

Site isolation issue in the DOM: Navigation component

Site isolation issue in the DOM: Navigation component

Mitigation bypass in the DOM: Service Workers component

CSP frame-src was not correctly enforced for paths

Same-origin policy bypass in the Networking: JAR component

Site isolation issue in the Graphics: WebRender component

Same-origin policy bypass in the DOM: Navigation component

Site isolation issue in the Networking: HTTP component

Spoofing issue in the DOM: Core & HTML component

Site isolation issue in the Networking component

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.

Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

Sandbox escape due to incorrect boundary conditions in the Telemetry component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape in the DOM: Workers component

Sandbox escape due to use-after-free in the DOM: Security component