Mozilla

During garbage collection extra operations were performed on a object that should not be. This could have led to a poten

The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which c

A website could have obscured the full screen notification by using the file open dialog. This could have led to user co

A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to c

Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. T

An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document

Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a serv

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to

A vulnerability was found in Translator PoqDev Add-On 1.0.11 on Firefox. It has been rated as problematic. This issue af

Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create publ

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remo

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence

During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed fr

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer

In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly u

A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential

During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to

In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memo

A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds writ

A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to

Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence

Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 11

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then

Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when al

Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be down

Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sen

Search queries in the default search engine could appear to have been the currently navigated URL if the search query it

When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErro

When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to

On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow

When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been cre

When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been cr

An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user

When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a u

A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune tim

Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that w

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no l

When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only

A website could have obscured the full screen notification by using a URL with a scheme handled by an external program,

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that d

A website could have obscured the full screen notification by using the file open dialog. This could have led to user co

In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pote

Race conditions in reference counting code were found through code inspection. These could have resulted in potentially

An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in i

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from anot