Vulnerabilities

A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections.

By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash.

A malicious extension could have opened a popup window lacking an address bar.

If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user.

A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL.

Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8.

Mozilla developers reported memory safety bugs present in Firefox 86.