170 results · Clear filters · Feed
-
High 8.1
If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.…
-
High 8.2
A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability …
-
High 7.5
When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. Thi…
-
High 8.6
A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have tr…
-
High 8.8
When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability a…
-
High 7.5
Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed eviden…
-
High 8.1
Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory …
-
High 8.1
Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 7.5
It was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects …
-
High 8.8
A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vuln…
-
High 7.8
The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garb…
-
High 7.5
GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affect…
-
High 8.8
In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This…
-
High 7.5
A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection s…
-
High 8.4
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript executio…
-
High 8.8
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence…
-
High 7.5
Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption …
-
High 8.1
If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or p…
-
High 8.4
`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienc…
-
High 8.1
Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue on…
-
High 8.1
Memory safety bugs present in Firefox 122. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.3
When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vuln…
-
High 8.1
Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence…
-
High 7.5
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* Thi…
-
High 7.5
When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in …
-
High 8.8
The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially e…
-
High 7.5
An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability a…
-
High 7.5
In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploi…
-
High 8.8
Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence…
-
High 8.8
A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, F…
-
High 8.8
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
High 8.8
TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect T…
-
High 8.8
Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerabil…
-
High 7.5
During garbage collection extra operations were performed on a object that should not be. This could have led to a pote…
-
High 7.5
Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. …
-
High 8.8
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
KEV Oct 2, 2023 -
High 8.8
libwebp: OOB write in BuildHuffmanTable
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
KEV Sep 13, 2023 -
High 8.8
Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabili…
-
High 7.5
Browsing Context potentially not cleared when closing Private Window
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This …
-
High 7.8
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker t…