Vulnerabilities

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13.

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state.

When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code.

In some cases, an untrusted input stream was copied to a stack buffer without checking its size.

Race conditions in reference counting code were found through code inspection.

An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis.

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy.