712 results · Feed
-
Unscored —
When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. …
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed ev…
-
Unscored —
Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaSc…
-
Unscored —
By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the dow…
-
Unscored —
When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential …
-
Unscored —
A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, lead…
-
Unscored —
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite …
-
Unscored —
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin…
-
Unscored —
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led t…
-
Unscored —
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their cho…
-
Unscored —
When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting…
-
Unscored —
The code for downloading files did not properly take care of special characters, which led to an attacker being able to…
-
Unscored —
JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mi…
-
Unscored —
Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker th…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some o…
-
Unscored —
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak privat…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed ev…
-
Unscored —
When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially explo…
-
Unscored —
Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We…
-
Unscored —
When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to m…
-
Unscored —
Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memor…
-
Unscored —
When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were l…
-
Unscored —
When processing callbacks that occurred during window flushing in the parent process, the associated window may die; ca…
-
Unscored —
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malici…
-
Unscored —
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at …
-
Unscored —
A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corrupti…
-
Unscored —
A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a po…
-
Unscored —
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Not…
-
Unscored —
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Not…
-
Unscored —
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can …
-
Unscored —
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be …
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some o…
-
High 8.1CVE-2020-6819 Exploited
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are a…
KEV Nov 3, 2021 -
High 8.1CVE-2020-6820 Exploited
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of …
KEV Nov 3, 2021 -
Unscored —
When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method…
-
Unscored —
On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDeco…
-
Unscored —
Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefo…
-
Unscored —
When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android coul…
-
Unscored —
A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potenti…