2,316 results · Feed
-
High 8.8
Memory safety bugs fixed in Firefox 109
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. T…
-
Unscored —
Logic bug in process allocation allowed to read arbitrary files
A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `file://` context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file…
-
High 8.8
Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…
-
Medium 6.5
Calls to console.log allowed bypassing Content Security Policy via format directive
Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109,…
-
Medium 6.5
Creation of duplicate SystemPrincipal from less secure contexts
A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.
-
Unscored —
URL being dragged from cross-origin iframe into same tab triggers navigation
Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.
-
High 8.8
Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensi…
-
Medium 4.3
Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to the…
-
High 8.8
An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This…
-
Unscored —
When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. Thi…
-
Unscored —
Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corrupti…
-
High 8.8
When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not c…
-
Unscored —
Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorr…
-
High 8.8
Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-fr…
-
Medium 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…
-
High 8.8
Memory safety bugs present in Firefox 109. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.8
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
Unscored —
When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be withi…
-
Medium 6.5
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipp…
-
Medium 6.5
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have res…
-
Medium 4.3
By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potent…
-
High 8.8
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially…
-
Medium 4.3
Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private brow…
-
High 8.8
After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path …
-
Unscored —
A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chro…
-
High 8.1
After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote pat…
-
Medium 6.5
The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…
-
Medium 5.9
The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerabil…
-
Medium 6.5
When downloading an update for an addon, the downloaded addon update's version was not verified to match the version se…
-
High 8.8
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the result…
-
Medium 6.5
The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applic…
-
High 8.8
In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the numbe…
-
Medium 4.3
If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, …
-
High 8.8
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the result…
-
Medium 6.5
A malicious website that could create a popup could have resized the popup to overlay the address bar with its own cont…
-
High 8.8
The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evi…
-
Medium 6.1
SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if att…
-
High 8.8
An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. Thi…
-
Medium 6.1
The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however …
-
Critical 9.8
Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Fire…