Mozilla

Session history navigations may have led to a use-after-free and potentially exploitable crash.

A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash.

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in…

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g.

An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.

While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type.

Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>.

An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior.

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy.

When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write.

Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincipals</code>.

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10.

An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link.

A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption.

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash.

When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible.

Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy.

Applying a CSS filter effect could have accessed out of bounds memory.

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context.

After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.

A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`.

When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code.

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows.