Vulnerabilities

Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112.

Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service.

Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal.

A maliciously crafted favicon could have led to an out of memory crash.

Service workers could reveal script base URL due to dynamic `import()`.