249 results · Clear filters · Feed
-
Medium 5.4
A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulti…
-
Medium 6.1
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS th…
-
Medium 4.3
An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possi…
-
Medium 6.1
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and …
-
Medium 5.4
The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This v…
-
Medium 6.5
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable cra…
-
Medium 6.5
A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This v…
-
Medium 6.1
An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devto…
-
Medium 6.3
Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on …
-
Medium 6.1
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a si…
-
Medium 4.7
Race condition in permission assignment
A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
-
Medium 4.7
By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clic…
-
Medium 6.1
Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another si…
-
Medium 4.3
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were fu…
-
Medium 5.9
When importing resources using Web Workers, error messages would distinguish the difference between `application/javasc…
-
Medium 6.1
A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting pe…
-
Medium 5.6
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
-
Medium 4.3
If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the wi…
-
Medium 4.0
If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and …
-
Medium 5.9
On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered b…
-
Medium 5.5
A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permiss…
-
Medium 6.1
Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content…
-
Medium 6.5
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow…
-
Medium 6.1
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacki…
-
Medium 6.1
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control th…
-
Medium 6.1
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potent…
-
Medium 6.1
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user…
-
Medium 6.5
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another w…
-
Medium 4.3
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led…
-
Medium 6.5
In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox…
-
Medium 4.3
A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the addre…
-
Medium 6.5
When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have over…
-
Medium 6.5
A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefo…
-
Medium 6.5CVE-2024-0741 Public exploit
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…
-
Medium 4.3
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to…
-
Medium 5.3CVE-2023-1999 Public exploit
Use after free in libwebp
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
Medium 6.5
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable c…
-
Medium 6.5
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…
-
Medium 6.5
Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Fi…