704 results · Clear filters · Feed
-
High 8.8
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged…
-
High 8.8
Memory safety bugs fixed in Firefox 128 and Thunderbird 128
Memory safety bugs present in Firefox 127 and Thunderbird 127. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 1…
-
High 8.8
Memory corruption in NSS
When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.
-
High 8.2
Out-of-bounds read in clipboard component
Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 128 and Thunderbird < 128.
-
High 8.8
Leaving pointerlock by pressing the escape key could be prevented
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `<select>` element over certain permission prompts. This could be used to confuse a user into giving a site unintended per…
-
High 8.8
Firefox Android missed activation delay to prevent tapjacking
Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128.
-
High 7.4
Memory corruption in thread creation
In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
-
High 7.5
Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13
Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabi…
-
High 7.5
An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section…
-
High 7.0
Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed eviden…
-
High 8.6
By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potential…
-
High 7.5
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects…
-
High 8.1
If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.…
-
High 8.2
A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability …
-
High 7.5
When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. Thi…
-
High 8.6
A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have tr…
-
High 8.1
Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite ano…
-
High 8.8
When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability a…
-
High 7.5
Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed eviden…
-
High 8.1
Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory …
-
High 8.1
Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 7.5
It was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects …
-
High 8.8
A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vuln…
-
High 7.8
The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garb…
-
High 7.5
GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affect…
-
High 8.8
In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This…
-
High 7.5
A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection s…
-
High 8.4
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript executio…
-
High 8.8
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence…
-
High 7.5
Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption …
-
High 8.1
If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or p…
-
High 8.4
`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienc…
-
High 8.1
Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue on…
-
High 8.1
Memory safety bugs present in Firefox 122. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.3
When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vuln…
-
High 8.1
Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence…
-
High 7.5
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* Thi…
-
High 7.5
When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in …
-
High 8.8
The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially e…
-
High 7.5
An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability a…