Firefox vulnerabilities

A use-after-free vulnerability was found in the JavaScript Engine component of Firefox and Thunderbird. It is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

An uninitialized memory vulnerability was found in the Audio/Video: Web Codecs component of Firefox and Thunderbird. The flaw was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Information disclosure vulnerability in the Graphics: Canvas2D component due to uninitialized memory. Fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

A vulnerability in the Graphics: WebGPU component of Firefox and Thunderbird due to incorrect boundary conditions. The flaw was fixed in versions 149.0.2 of both products.

Incorrect boundary conditions and integer overflow were found in the Graphics: Text component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

A vulnerability in the Layout: Text and Fonts component of Firefox and Thunderbird due to incorrect boundary conditions. The flaw was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A vulnerability in the Audio/Video: Web Codecs component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A vulnerability in the Audio/Video: Web Codecs component of Firefox and Thunderbird is caused by incorrect boundary conditions. This flaw could lead to unexpected behavior or potential exploitation by an attacker.

Incorrect boundary conditions and integer overflow were found in the Graphics component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A vulnerability in the Audio/Video playback component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A sandbox escape vulnerability exists in the Telemetry component due to incorrect boundary conditions. This flaw was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A vulnerability in the Graphics: Canvas2D component of Firefox and Thunderbird is caused by incorrect boundary conditions. This flaw may lead to unspecified security consequences.

A vulnerability in the Graphics: Canvas2D component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw has been fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

A use-after-free vulnerability was found in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in versions 148 of both applications.

An information disclosure vulnerability due to uninitialized memory in Firefox and Firefox Focus for Android. This flaw was fixed in Firefox 148.

Use-after-free vulnerability in the Layout: Scrolling and Overflow component of Firefox. This flaw was fixed in Firefox 147.0.2.

Memory safety bugs were found in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, and Thunderbird 146. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with sufficient effort.

A use-after-free vulnerability was found in the IPC component of Firefox and Thunderbird. It is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

An integer overflow in the Graphics component of Firefox and Thunderbird allows a sandbox escape. The vulnerability is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

A sandbox escape vulnerability exists in the Graphics: CanvasWebGL component due to incorrect boundary conditions. This flaw was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

This vulnerability allows bypassing security mechanisms in the DOM component of Firefox and Thunderbird. The flaw is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

A spoofing vulnerability was detected in the Firefox browser. The vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30.

When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event. This vulnerability was fixed in Firefox 144.

A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. The vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

Incorrect boundary conditions exist in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

A same-origin policy bypass exists in the Layout component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

A spoofing issue has been identified in the Address Bar component of the Firefox browser. The vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.

Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

In Firefox (version 141) there is a spoofing vulnerability that can be exploited via a crafted URL using a blob: URI, hiding the true origin of the page. This issue only affects Android. The vulnerability was fixed in Firefox 141.

The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. Fixed in Firefox 141, Firefox ESR 115.26, 128.13, 140.1, and Thunderbird 141, 128.13, 140.1.

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack, while Baseline-JIT read the entire 64 bits. Fixed in Firefox 141, Firefox ESR 115.26, 128.13, 140.1, and Thunderbird 141, 128.13, 140.1.

The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay. An attacker could trick a user into granting an exception and loading a webpage over HTTP.

When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<object>` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

Firefox could incorrectly parse a URL and rewrite it to youtube.com when parsing an 'embed' tag. This could bypass website security checks restricting embed domains. Fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, Thunderbird 128.12.

The WebCompat extension could expose a persistent browser UUID that persisted between containers and normal/private browsing mode, but not profiles. This was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This was fixed in Firefox 139 and Thunderbird 139.

A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

The 'Copy as cURL' feature in Firefox for Windows improperly escapes the ampersand character, which could allow an attacker to trick a user into using a crafted command, potentially leading to local code execution on the user's system. This bug only affects Firefox for Windows; other versions are unaffected. Fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution. This bug only affects Firefox for Windows. Fixed in Firefox ESR 128.10, Firefox ESR 115.23, and Thunderbird 128.10.

A race condition existed in nsHttpTransaction in Firefox that could have been exploited to cause memory corruption. This vulnerability was fixed in Firefox 137.0.2.

By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability was fixed in Firefox 137.

An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137.

Android apps can load web pages using the Custom Tabs feature. This feature supported a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.