Vulnerabilities

Memory safety bugs present in Firefox 125.

A file dialog shown while in full-screen mode could have resulted in the window remaining disabled.

An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior.

The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members.

When a network error occurred during page load, the prior content could have remained in view with a blank URL bar.

An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values.

A memory allocation check was missing which would lead to a use-after-free if the allocation failed.

Different techniques existed to obscure the fullscreen notification in Firefox for Android.

Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest.

Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free.

Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10.

When saving a page to PDF, certain font styles could have led to a potential use-after-free crash.

When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses.

A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions.

If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed.

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.