2,316 results · Feed
-
Unscored —
Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team rep…
-
Unscored —
Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This atta…
-
Unscored —
Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately pri…
-
Unscored —
A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox < 113.
-
Unscored —
Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.
-
High 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…
-
High 8.8
Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruptio…
-
High 8.8
Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.8
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a f…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
Medium 4.3
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potent…
-
High 8.8
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have…
-
Medium 6.5
When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual l…
-
Medium 6.5
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable n…
-
Unscored —
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Fir…
-
Unscored —
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to pot…
-
Unscored —
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox <…
-
High 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permis…
-
Unscored —
Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCr…
-
Unscored —
A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ES…
-
Unscored —
When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 11…
-
Unscored —
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in …
-
Medium 6.5
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This ma…
-
High 8.8
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global o…
-
Unscored —
Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resu…
-
Medium 6.5
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…
-
High 8.8
Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run att…
-
Medium 6.5
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, …
-
Unscored —
Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-contr…
-
Medium 6.5
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused me…
-
High 8.8
Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruptio…
-
Unscored —
Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-ex…
-
Unscored —
An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, res…
-
High 8.8
Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscree…
-
Unscored —
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename…
-
Medium 6.5
Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Fi…
-
Unscored —
Notification permissions persisted between Normal and Private Browsing on Android
Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was granted in. This lead to the possibility of notifications to be displayed during different browsing sessions. *This bug only …
-
Unscored —
Arbitrary file read from GTK drag and drop on Linux
Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to `DataTransfer.setData`. This vulnerability affects Firefox …
-
Unscored —
Malicious command could be hidden in devtools output on Windows
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird …