363 results · Clear filters · Feed
-
Medium 6.5
Creation of duplicate SystemPrincipal from less secure contexts
A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.
-
Medium 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…
-
Medium 6.5
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipp…
-
Medium 4.3
Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private brow…
-
Medium 6.5
The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…
-
Medium 6.5
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…
-
Medium 6.5
An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was z…
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.5
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Th…
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 6.1
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…
-
Medium 6.5
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resultin…
-
Medium 4.3
If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulner…
-
Medium 6.5
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so b…
-
Medium 6.5
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the…
-
Medium 6.5
Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. T…
-
Medium 4.3
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential use…
-
Medium 6.5
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the S…
-
Medium 6.5
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server t…
-
Medium 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen withou…
-
Medium 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…
-
Medium 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seei…
-
Medium 6.5
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free …
-
Medium 4.3
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers be…
-
Medium 6.5
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timin…
-
Medium 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …
-
Medium 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…
-
Medium 6.1
Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause…
-
Medium 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access…
-
Medium 6.5
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…
-
Medium 6.5
If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so,…
-
Medium 6.5
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…
-
Medium 6.5
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…
-
Medium 6.5
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/j…
-
Medium 6.5
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…
-
Medium 4.3
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…
-
Medium 6.5
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…
-
Medium 5.9
A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window …
-
Medium 4.3
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…