Vulnerabilities

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents.

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts.

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs.

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.

Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor.

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES.

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript.

Memory safety bugs were reported in Thunderbird 45.5.