363 results · Clear filters · Feed
-
Medium 6.1
A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting pe…
-
Medium 5.6
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
-
Medium 4.3
If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the wi…
-
Medium 4.0
If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and …
-
Medium 5.3
The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in …
-
Medium 6.2
An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently tr…
-
Medium 5.9
On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered b…
-
Medium 6.5
In certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds reads. This vulnerability…
-
Medium 5.5
A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permiss…
-
Medium 6.1
Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content…
-
Medium 6.5
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow…
-
Medium 6.1
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacki…
-
Medium 5.9
An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. *…
-
Medium 6.5
The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and un…
-
Medium 6.1
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control th…
-
Medium 6.1
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potent…
-
Medium 6.1
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user…
-
Medium 6.5
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another w…
-
Medium 4.3
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led…
-
Medium 6.5
Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.
-
Medium 4.3
A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitr…
-
Medium 6.5
In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox…
-
Medium 4.3
A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the addre…
-
Medium 6.5
When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have over…
-
Medium 6.5
A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefo…
-
Medium 6.5CVE-2024-0741 Public exploit
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…
-
Medium 4.3
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to…
-
Medium 6.5
A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow un…
-
Medium 5.3CVE-2023-1999 Public exploit
Use after free in libwebp
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…
-
Medium 6.5
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden…
-
Medium 6.5
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable …
-
Medium 5.5
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the servic…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
Medium 6.5
When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual l…
-
Medium 6.5
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This ma…
-
Medium 6.5
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…
-
Medium 6.5
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, …
-
Medium 6.5
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused me…
-
Medium 6.5
Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Fi…
-
Medium 6.5
Calls to console.log allowed bypassing Content Security Policy via format directive
Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109,…