Vulnerabilities

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user.

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events.

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting.

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion.

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling.

Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2.