Mozilla Firefox

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

Spoofing issue in the Privacy: Anti-Tracking component

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Potential opening of private browsing tabs in normal browsing windows

Mitigation bypass in the File Handling component

Race condition in nsHttpTransaction could lead to memory corruption

Incorrect boundary conditions in the JavaScript: GC component

Devtools' preview ignored CSP headers

Memory safety bugs fixed in Firefox 138 and Thunderbird 138

Same-origin policy bypass in the Layout component

Spoofing issue in the WebAuthn component in Firefox for Android

JIT optimization bug with different stack slot sizes

Specially crafted filename could be used to obscure download type

A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115.

A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. *This bug only affects Firefox Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131.

Spoofing issue in the Toolbar component in Firefox for Android

When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.

Spoofing issue in the Address Bar component

The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: postMessage component

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102.

Sandboxed iframes allowed links to open in external apps (Android only)

Memory safety bug fixed in Firefox 152

Sensitive user data could be leaked to other applications through Reader mode

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. <br>*This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.*. This vulnerability affects Firefox < 97.

Some non-writable Object properties could be modified

Denial-of-service in the Graphics: ImageLib component

JavaScript alerts could impede UI interaction or allow denial of service attacks

Spoofing issue in the Address Bar component of Firefox Focus for Android

Address bar could be spoofed on Android using visibilitychange

Mitigation bypass in the Privacy: Anti-Tracking component

Denial-of-service in the Audio/Video: Playback component

Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS

Spoofing issue in the Address Bar component

Same-origin policy bypass in the Request Handling component

Address bar spoofing on iOS using long hostnames

Cross-site request forgery via storage access API redirects

Clickjacking issue in the WebExtensions component in Firefox for Android