Vulnerabilities

URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not…

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain.

A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction.

Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited.

A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script.

A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy.

WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivil…

WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow WebExtensions to view specific content.

If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized.

The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab.

Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should.

When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered.

A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages.

A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations.

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script.

Memory safety bugs were reported in Firefox 58.

Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6.