Vulnerabilities

Memory safety bugs present in Firefox 120.

Browser tab titles were being leaked by GNOME to system logs.

Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler.

Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox.

A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe.

In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one.

The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts.

TypedArrays can be fallible and lacked proper exception handling.

`EncryptingOutputStream` was susceptible to exposing uninitialized data.

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva".

Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5.

The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor.

The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode.

The `VideoBridge` allowed any content process to use textures produced by remote decoders.

A use-after-free condition affected TLS socket creation when under memory pressure.

Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling.

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary.

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver.