Vulnerabilities

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin.

An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks.

An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list.

WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox.

When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabled by default.

Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history.

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections.

A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash.

Two use-after-free errors during DOM operations resulting in potentially exploitable crashes.

The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar without any user notification.

An integer overflow during the parsing of XML using the Expat library.

Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after the mode is exited.

A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only.

A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only.

A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new page is loaded.

This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files.

The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process.

When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file.

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash.

Memory safety bugs were reported in Firefox 49.