In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber (or XMLGetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions.
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks.
If an attacker could find a way to trigger a particular code path in SafeRefPtr, it could have triggered a crash or potentially be leveraged to achieve code execution.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2024-2612
AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2024-2608
Last updated 28 February 2025
Last updated 3 December 2024
Chromium: CVE-2023-4863 Heap buffer overflow in WebP
A Linux user opening the print preview dialog could have caused the browser to crash.
Last updated 24 July 2024
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior. Note: This issue only affects 32-bit ARM devices.
Last updated 24 July 2024
Last updated 28 February 2025
A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions.
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, and Thunderbird < 128.5.
A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack.
Last updated 3 December 2024
Chromium: CVE-2023-5217 Heap buffer overflow in vp8 encoding in libvpx
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load.
Last updated 24 July 2024
In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain.
An unchecked return value in TLS handshake code could have caused a potentially exploitable crash.
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash.
A malicious devtools extension could have been used to escalate privileges.
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.
A permission leak could have occurred from a trusted site to an untrusted site via embed or object elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash.
Last updated 6 November 2024