145 results · Clear filters · Feed
-
Medium 6.5
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, …
-
Medium 6.5
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused me…
-
Medium 6.5
Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Fi…
-
Medium 6.5
Calls to console.log allowed bypassing Content Security Policy via format directive
Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109,…
-
Medium 6.5
Creation of duplicate SystemPrincipal from less secure contexts
A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.
-
Medium 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…
-
Medium 6.5
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipp…
-
Medium 4.3
Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private brow…
-
Medium 6.5
The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…
-
Medium 6.5
When downloading an update for an addon, the downloaded addon update's version was not verified to match the version se…
-
Medium 4.3
If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, …
-
Medium 6.5
A malicious website that could create a popup could have resized the popup to overlay the address bar with its own cont…
-
Medium 6.1
SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if att…
-
Medium 6.1
The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however …
-
Medium 6.1
Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect …
-
Medium 6.5
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object…
-
Medium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…
-
Medium 6.5
In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. …
-
Medium 6.5
The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to includ…
-
Medium 6.5
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…
-
Medium 6.5
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pot…
-
Medium 6.5
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…
-
Medium 6.5
An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which wa…
-
Medium 6.5
An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was z…
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.5
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Th…
-
Medium 4.3
The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This…
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 6.1
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…
-
Medium 5.3
When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerabilit…
-
Medium 4.3
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of pre…
-
Medium 6.1
When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus l…
-
Medium 6.5
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resultin…
-
Medium 4.3
If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulner…
-
Medium 6.5
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so b…
-
Medium 6.5
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the…
-
Medium 6.5
Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. T…
-
Medium 5.5
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…
-
Medium 4.3
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential use…
-
Medium 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…