Mozilla

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. Th

A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory c

Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of

When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting

The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that tri

When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element cl

A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to thi

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER

The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run c

Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled)

By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolo

The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while r

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user.

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to

When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have r

The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgr

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evi

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evi

Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corru

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory

Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another o

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corrup

Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of mem

Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed ev

When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to

Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerabil

Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI sp

Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery

Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed ev

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed ev

Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory

After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be disp

A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note:

A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash

Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered du

Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause

Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the poten

An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures

Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potenti

Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd pa

Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bug

Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or format

When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would

Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected t

A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library r