145 results · Clear filters · Feed
-
Medium 6.5
Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.…
-
Medium 4.3
Clickjacking the registerProtocolHandler info-bar
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
-
Medium 6.5
Unexpected GC during RegExp bailout processing
It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and…
-
Medium 6.5
Memory safety bugs fixed in Firefox 135.0.1
Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135.0.1.
-
Medium 6.5
Potential opening of private browsing tabs in normal browsing windows
A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
-
Medium 4.3
Fullscreen notification not properly displayed
The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
-
Medium 6.5CVE-2025-0242 EPSS 15%
Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could ha…
-
Medium 5.1
Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.…
-
Medium 5.3
Use-after-free when breaking lines in text
Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 12…
-
Medium 4.0
Alt-Svc ALPN validation failure when redirected
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
-
Medium 4.0
Compartment mismatch when parsing JavaScript JSON module
Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
-
Medium 5.4
WebChannel APIs susceptible to confused deputy attack
The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox…
-
Medium 6.5
Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. Thi…
-
Medium 6.5
A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_U…
-
Medium 5.4
The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature ve…
-
Medium 5.4
A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulti…
-
Medium 6.1
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS th…
-
Medium 4.3
The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could ha…
-
Medium 4.3
An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possi…
-
Medium 4.3
A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. T…
-
Medium 6.1
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and …
-
Medium 5.4
The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This v…
-
Medium 6.5
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable cra…
-
Medium 6.5
A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This v…
-
Medium 6.5
When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially le…
-
Medium 6.1
A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permis…
-
Medium 5.3
By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine i…
-
Medium 6.1
An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devto…
-
Medium 6.1
If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of ano…
-
Medium 6.3
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into g…
-
Medium 6.3
Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on …
-
Medium 6.1
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a si…
-
Medium 6.5
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a sp…
-
Medium 5.5
Incorrect listing of stack frames
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.
-
Medium 5.3
CSP violation leakage when using devtools
CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects Firefox < 128 and Thunderbird < 128.
-
Medium 4.3
Incorrect listing of stack frames
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.
-
Medium 6.3
Form validation popups could block exiting full-screen mode
Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefox < 128 and Thunderbird < 128.
-
Medium 4.3
Cursor could be moved out of the viewport using pointerlock.
It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulnerability affects Firefox < 128 and Thunderbird < 128.
-
Medium 4.7
Race condition in permission assignment
A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
-
Medium 5.4
By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the a…