1,432 results · Feed
-
Medium 4.3
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…
-
High 8.8
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…
-
High 7.5
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming …
-
Medium 6.5
Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>…
-
Critical 9.6CVE-2022-26486 Exploited
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…
KEV Mar 7, 2022 -
Critical 9.8
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability af…
-
Medium 6.5
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a…
-
Critical 9.8
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, …
-
Critical 9.8
An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vuln…
-
High 7.5
Regular expression denial of service in Rust's regex crate
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…
-
Unscored —
The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session obj…
-
Unscored —
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such…
-
Unscored —
When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have …
-
Unscored —
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user…
-
Unscored —
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while …
-
Unscored —
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geol…
-
Unscored —
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled…
-
Unscored —
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to th…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some o…
-
Unscored —
A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory …
-
Unscored —
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. T…
-
Unscored —
An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a p…
-
Unscored —
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that h…
-
Unscored —
Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within …
-
Unscored —
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly esc…
-
Unscored —
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading ex…
-
Unscored —
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additi…
-
Unscored —
Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thu…
-
Unscored —
It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerabil…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed e…
-
Unscored —
During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corru…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed ev…
-
Unscored —
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downg…
-
Unscored —
Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potent…
-
Unscored —
Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered d…
-
Unscored —
A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable cras…
-
Unscored —
A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note…
-
Unscored —
Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memor…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed e…
-
Unscored —
If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses pr…