Vulnerabilities

Mozilla developers and community members reported memory safety bugs present in Firefox 68.

Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68.

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is…

If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content.

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed.

A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process.

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site.

WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context.

A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggering a user prompt or n…

A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash.

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application.

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware.