Firefox vulnerabilities

A sandbox escape vulnerability in Firefox and Firefox Focus for Android. This flaw was fixed in Firefox 151.

A use-after-free vulnerability was found in the JavaScript: WebAssembly component of Firefox. This flaw was fixed in Firefox 150.0.3.

A JIT miscompilation vulnerability exists in the JavaScript Engine of Firefox, which could lead to unexpected behavior. This issue was fixed in Firefox 150.0.3.

A vulnerability in the JavaScript Engine: JIT component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Memory safety bugs were present in Firefox 150.0.1, showing evidence of memory corruption. With enough effort, some could have been exploited to run arbitrary code. The vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.

Memory safety bugs were found in Firefox ESR 115.35.1, Firefox ESR 140.10.1, and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption, which could potentially be exploited to run arbitrary code.

A use-after-free vulnerability was found in the DOM: Networking component of Firefox and Thunderbird. The flaw was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.

An information disclosure vulnerability in the Audio/Video component of Firefox and Thunderbird due to incorrect boundary conditions. The flaw is fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

Memory safety bugs were found in Firefox ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with enough effort.

Memory safety bugs were found in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code. The vulnerabilities were fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Memory safety bugs were found in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption, potentially allowing arbitrary code execution. The vulnerability was fixed in Firefox 150 and Thunderbird 150.

A use-after-free vulnerability was found in the JavaScript Engine component of Firefox and Thunderbird. It is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

An uninitialized memory vulnerability was found in the Audio/Video: Web Codecs component of Firefox and Thunderbird. The flaw was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Information disclosure vulnerability in the Graphics: Canvas2D component due to uninitialized memory. Fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

A vulnerability in the Graphics: WebGPU component of Firefox and Thunderbird due to incorrect boundary conditions. The flaw was fixed in versions 149.0.2 of both products.

Incorrect boundary conditions and integer overflow were found in the Graphics: Text component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

A vulnerability in the Layout: Text and Fonts component of Firefox and Thunderbird due to incorrect boundary conditions. The flaw was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A vulnerability in the Audio/Video: Web Codecs component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A vulnerability in the Audio/Video: Web Codecs component of Firefox and Thunderbird is caused by incorrect boundary conditions. This flaw could lead to unexpected behavior or potential exploitation by an attacker.

Incorrect boundary conditions and integer overflow were found in the Graphics component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A vulnerability in the Audio/Video playback component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A sandbox escape vulnerability exists in the Telemetry component due to incorrect boundary conditions. This flaw was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A vulnerability in the Graphics: Canvas2D component of Firefox and Thunderbird is caused by incorrect boundary conditions. This flaw may lead to unspecified security consequences.

A vulnerability in the Graphics: Canvas2D component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw has been fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A use-after-free vulnerability was found in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in versions 148 of both applications.

An information disclosure vulnerability due to uninitialized memory in Firefox and Firefox Focus for Android. This flaw was fixed in Firefox 148.

Use-after-free vulnerability in the Layout: Scrolling and Overflow component of Firefox. This flaw was fixed in Firefox 147.0.2.

Memory safety bugs were found in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with sufficient effort.

A use-after-free vulnerability was found in the IPC component of Firefox and Thunderbird. It is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

An integer overflow in the Graphics component of Firefox and Thunderbird allows a sandbox escape. The vulnerability is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

A sandbox escape vulnerability exists in the Graphics: CanvasWebGL component due to incorrect boundary conditions. This flaw was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

This vulnerability allows bypassing security mechanisms in the DOM component of Firefox and Thunderbird. The flaw is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

In Firefox, a select option could partially obscure security prompts. A malicious site could use this to trick a user into granting permissions. This issue only affects Android versions of Firefox and affects Firefox < 129.

In Firefox, when configured to block the storage of all cookies, it was still possible to store data in localstorage using an iframe with a source of 'about:blank'. This could lead to malicious websites storing tracking data without user consent.

Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox versions below 115.

A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that object remained. This resulted in a potentially exploitable condition when the reference to that object was later reused.

The vulnerability allows an attacker to trick a user into submitting sensitive data to a malicious website by uploading files that contain symlinks. This affects Firefox versions below 115.

The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox versions below 115.

A vulnerability in Firefox (< 115) allows a website to obscure the fullscreen notification by using an option element, potentially causing delays due to an expensive computational function. This could lead to user confusion and possible spoofing attacks.

Insufficient validation in the Drag and Drop API, in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could have been leveraged to execute arbitrary code.

A vulnerability in Firefox allowed a document loaded from a data: URL resulting from a redirect to be loaded in the same process as the site that issued the redirect, bypassing site-isolation protections against Spectre-like attacks.

Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption, potentially allowing arbitrary code execution. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Under certain circumstances, a call to the bind function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Firefox improperly handled downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands. This bug only affects Firefox for Linux on certain distributions.

Using a redirect embedded into sourceMappingUrls could allow for navigation to external protocol links in sandboxed iframes without allow-top-navigation-to-custom-protocols. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.