Vulnerabilities

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory.

On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected onl…

The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions.

If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink is selected.

A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded.

A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being dis…

If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system.

An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns.

When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly l…

In certain circumstances a networking event listener can be prematurely released.

An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks.

The file picker dialog can choose and display the wrong local default directory when instantiated.

A segmentation fault can occur during some bidirectional layout operations.

A buffer overflow read during SVG filter color value operations, resulting in data exposure.

A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content.

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged acces…

A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks.

When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object.

Memory safety bugs were reported in Firefox 51.