358 results · Feed
-
Unscored —
An ambiguous file picker design could have confused users who intended to select and upload a single file into uploadin…
-
Unscored —
Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: Th…
-
Unscored —
The browser could have been confused into transferring a screen sharing state into another tab, which would leak uninte…
-
Unscored —
An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the addr…
-
Unscored —
Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially ex…
-
Unscored —
Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an i…
-
Unscored —
Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable cra…
-
Unscored —
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reporte…
-
Unscored —
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure th…
-
Unscored —
Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded was…
-
Unscored —
When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Polic…
-
Unscored —
One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.co…
-
Unscored —
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the conte…
-
Unscored —
The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to …
-
Unscored —
The developer page about:memory has a Measure function for exploring what object types the browser has allocated and th…
-
Unscored —
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file…
-
Unscored —
Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap c…
-
Unscored —
Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitiv…
-
Unscored —CVE-2020-16012 Public exploit
Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak c…
-
Unscored —
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video …
-
Unscored —
The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they…
-
Unscored —
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been u…
-
Unscored —
When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wro…
-
Unscored —
When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary heade…
-
Unscored —
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service w…
-
Unscored —
By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab w…
-
Unscored —
Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network…
-
Unscored —
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes c…
-
Unscored —
When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not trig…
-
Unscored —
If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there w…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corr…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed ev…
-
Unscored —
When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into i…
-
Unscored —
Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a…
-
Unscored —
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field…
-
Unscored —
If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, …
-
Unscored —
Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by i…
-
Unscored —
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populate…