Mozilla Firefox any version

Use-after-free in the JavaScript: GC component

A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126.

Other issue in the Storage: IndexedDB component

In certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds reads. This vulnerability affects Firefox < 125.

Incorrect boundary conditions in the DOM: Device Interfaces component

JavaScript engine only wrote partial return value to stack

Incorrect JavaScript state machine for generators

The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. This vulnerability affects Firefox < 126.

If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability affects Firefox < 107.

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

Uninitialized memory in the JavaScript Engine component

Incorrect parsing of URLs could have allowed embedding of youtube.com

Spoofing issue in the Form Autofill component

URL being dragged from cross-origin iframe into same tab triggers navigation

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Logic bug in process allocation allowed to read arbitrary files

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

Spoofing issue in the Privacy: Anti-Tracking component

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Potential opening of private browsing tabs in normal browsing windows

Mitigation bypass in the File Handling component

Race condition in nsHttpTransaction could lead to memory corruption

Incorrect boundary conditions in the JavaScript: GC component

Devtools' preview ignored CSP headers

Memory safety bugs fixed in Firefox 138 and Thunderbird 138

Same-origin policy bypass in the Layout component

Spoofing issue in the WebAuthn component in Firefox for Android

JIT optimization bug with different stack slot sizes

Specially crafted filename could be used to obscure download type

A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.

A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. *This bug only affects Firefox Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131.

Spoofing issue in the Toolbar component in Firefox for Android

When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.

The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed

Mitigation bypass in the DOM: postMessage component

Spoofing issue in the Address Bar component

Mitigation bypass in the DOM: Security component

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102.

Memory safety bug fixed in Firefox 152