Firefox vulnerabilities

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some showed evidence of memory corruption, potentially exploitable to run arbitrary code. Fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

A web page could trick a user into setting that site as the default handler for a custom URL protocol. Fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

The vulnerability allowed interrupting RegExp processing and running additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. Fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Memory safety bugs present in Firefox 135 could lead to memory corruption and potentially arbitrary code execution. Fixed in Firefox 135.0.1.

The z-order of browser windows could be manipulated to hide the fullscreen notification, potentially enabling spoofing attacks. Fixed in Firefox 135 and Thunderbird 135.

The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.

A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

When using an invalid protocol scheme, an attacker could spoof the address bar. This issue only affected Android operating systems. Fixed in Firefox 134.

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been bypassed. This vulnerability was fixed in Firefox 134.

Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, potentially leading to use-after-free. Fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

The WebChannel API did not check the sending principal but accepted the principal being sent, which could lead to privilege escalation attacks. Fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

In Firefox, a select option could partially obscure security prompts. A malicious site could use this to trick a user into granting permissions. This issue only affects Android versions of Firefox and affects Firefox < 129.

In Firefox, when configured to block the storage of all cookies, it was still possible to store data in localstorage using an iframe with a source of 'about:blank'. This could lead to malicious websites storing tracking data without user consent.

Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox versions below 115.

A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that object remained. This resulted in a potentially exploitable condition when the reference to that object was later reused.

The vulnerability allows an attacker to trick a user into submitting sensitive data to a malicious website by uploading files that contain symlinks. This affects Firefox versions below 115.

The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox versions below 115.

A vulnerability in Firefox (< 115) allows a website to obscure the fullscreen notification by using an option element, potentially causing delays due to an expensive computational function. This could lead to user confusion and possible spoofing attacks.

Insufficient validation in the Drag and Drop API, in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could have been leveraged to execute arbitrary code.

A vulnerability in Firefox allowed a document loaded from a data: URL resulting from a redirect to be loaded in the same process as the site that issued the redirect, bypassing site-isolation protections against Spectre-like attacks.

Similar to CVE-2023-28163, when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Firefox and Thunderbird on Windows. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

Protocol handlers 'ms-cxh' and 'ms-cxh-full' could have been leveraged to trigger a denial of service. This attack only affects Windows. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

An attacker could have positioned a datalist element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

A vulnerability in the RLBox Expat driver involves an out-of-bounds read that could lead to a crash. This affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption, potentially allowing arbitrary code execution. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Under certain circumstances, a call to the bind function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Firefox improperly handled downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands. This bug only affects Firefox for Linux on certain distributions.

Using a redirect embedded into sourceMappingUrls could allow for navigation to external protocol links in sandboxed iframes without allow-top-navigation-to-custom-protocols. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

When handling the filename directive in the Content-Disposition header, the filename would be truncated if it contained a NULL character. This could lead to reflected file download attacks potentially tricking users to install malware.

Under specific circumstances a WebExtension may have received a jar:file:/// URI instead of a moz-extension:/// URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Multiple race conditions in font initialization could have led to memory corruption and execution of attacker-controlled code. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced, resulting in memory corruption and a potentially exploitable crash. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

A website could obscure the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could lead to user confusion and possible spoofing attacks. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would resolve those in the context of the current user. This bug only affects Firefox on Windows.

While implementing AudioWorklets, some code may have casted one type to another invalid dynamic type. This could have led to a potentially exploitable crash. The vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have led future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Memory safety bugs are present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and it is presumed that with enough effort some could have been exploited to run arbitrary code. The vulnerability affects Firefox < 110 and Firefox ESR < 102.8.

When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Failed module load requests were not checked for cancellation, causing a use-after-free in ScriptLoadContext in Firefox and Thunderbird. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.