Vulnerabilities

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking.

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin.

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin.

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1.

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack.

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability.

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes.

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support.

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events.

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment.

Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor.

The date picker could partially obscure security prompts.

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free.

Unexpected marking work at the start of sweeping could have led to a use-after-free.

ANGLE failed to initialize parameters which lead to reading from uninitialized memory.

It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site.

Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection.

Editor code failed to check an attribute value.

Incomplete WebAssembly exception handing could have led to a use-after-free.

A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution.

Insufficient checks when processing graphics shared memory could have led to memory corruption.

Select options could obscure the fullscreen notification dialog.

By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window.

By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system.

Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6.